# SSL setting up problem

**URL:** <https://community.graylog.org/t/ssl-setting-up-problem/3963>\
**Category:** Graylog Central (peer support)\
**Created:** [January 29, 2018, 12:17pm UTC](https://community.graylog.org/t/ssl-setting-up-problem/3963 "2018-01-29T12:17:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![madi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/madi/32/396_2.png) [@madi](https://community.graylog.org/u/madi)\
**Post date:** [January 29, 2018, 12:17pm UTC](https://community.graylog.org/t/ssl-setting-up-problem/3963/1 "2018-01-29T12:17:08Z")

</div>

I have three node setup, lets say its:

**[server1.graylog.mydomain.com](http://server1.graylog.mydomain.com)**  
**[server2.graylog.mydomain.com](http://server2.graylog.mydomain.com)**  
**[server3.graylog.mydomain.com](http://server3.graylog.mydomain.com)**

in front of them i have a network load balancer **[graylog.mydomain.com](http://graylog.mydomain.com)**

I have two signed certificates for

\*.graylog.mydomain.com

and

[graylog.mydomain.com](http://graylog.mydomain.com)

my setup:  
**rest\_listen\_uri = [https://server1.graylog.mydomain.com:12900/api/](https://server1.graylog.mydomain.com:12900/api/)**  
**rest\_transport\_uri = [https://server1.graylog.mydomain.com:12900/api/](https://server1.graylog.mydomain.com:12900/api/)**

**rest\_listen\_uri = [https://server2.graylog.mydomain.com:12900/api/](https://server2.graylog.mydomain.com:12900/api/)**  
**rest\_transport\_uri = [https://server2.graylog.mydomain.com:12900/api/](https://server2.graylog.mydomain.com:12900/api/)**

**rest\_listen\_uri = [https://server3.graylog.mydomain.com:12900/api/](https://server3.graylog.mydomain.com:12900/api/)**  
**rest\_transport\_uri = [https://server3.graylog.mydomain.com:12900/api/](https://server3.graylog.mydomain.com:12900/api/)**

with \*.graylog.mydomain.com certificate

AND

**web\_listen\_uri = [https://graylog.mydomain.com:9000/](https://graylog.mydomain.com:9000/)**  
**web\_endpoint\_uri = [https://graylog.mydomain.com:12900/api/](https://graylog.mydomain.com:12900/api/)**

with [graylog.mydomain.com](http://graylog.mydomain.com) certificate

When I access the web ui with [https://graylog.mydomain.com](https://graylog.mydomain.com) (443-\>9000)

it works fine except:

> [graylog.mydomain.com:12900](http://graylog.mydomain.com:12900) uses an invalid security certificate.  
> The certificate is not valid for the name [graylog.mydomain.com](http://graylog.mydomain.com).  
> Error code: SSL\_ERROR\_BAD\_CERT\_DOMAIN

I add exception and everything is perfectly fine. I understand that my cert \*.graylog.mydomain.com is not suitable for the request. [server3.graylog.mydomain.com](http://server3.graylog.mydomain.com) and so on is not registered in my DNS, do i have to register this to get it working? (what web\_endpoint\_uri would i need to setup?) Is this possible to configure this only withing graylog configuration?

I would like to have valid ssl between nodes and in web ui.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [January 29, 2018, 3:34pm UTC](https://community.graylog.org/t/ssl-setting-up-problem/3963/2 "2018-01-29T15:34:09Z")

</div>

You can include `graylog.example.com` and `*.graylog.example.com` in a single X.509 certificate using different Subject Alternative Names.

- [https://en.wikipedia.org/wiki/Subject\_Alternative\_Name](https://en.wikipedia.org/wiki/Subject_Alternative_Name)
- [http://docs.graylog.org/en/2.4/pages/configuration/https.html#creating-a-self-signed-private-key-certificate](http://docs.graylog.org/en/2.4/pages/configuration/https.html#creating-a-self-signed-private-key-certificate)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 12, 2018, 3:34pm UTC](https://community.graylog.org/t/ssl-setting-up-problem/3963/3 "2018-02-12T15:34:17Z")

</div>

Closed on February 12, 2018, 3:34pm UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.